Implement KeyedStoreICs to grow arrays on out-of-bound stores.

src/arm/codegen-arm.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 72 matching lines @@
 void ElementsTransitionGenerator::GenerateSmiOnlyToDouble(
     MacroAssembler* masm, Label* fail) {
   // ----------- S t a t e -------------
   //  -- r0    : value
   //  -- r1    : key
   //  -- r2    : receiver
   //  -- lr    : return address
   //  -- r3    : target map, scratch for subsequent call
   //  -- r4    : scratch (elements)
   // -----------------------------------
-  Label loop, entry, convert_hole, gc_required;
+  Label loop, entry, convert_hole, gc_required, only_change_map, done;
   bool vfp3_supported = CpuFeatures::IsSupported(VFP3);
+
+  // Check for empty arrays, which only require a map transition and no changes
+  // to the backing store.
+  __ ldr(r4, FieldMemOperand(r2, JSObject::kElementsOffset));
+  __ CompareRoot(r4, Heap::kEmptyFixedArrayRootIndex);
+  __ b(eq, &only_change_map);
+
   __ push(lr);
-
-  __ ldr(r4, FieldMemOperand(r2, JSObject::kElementsOffset));
   __ ldr(r5, FieldMemOperand(r4, FixedArray::kLengthOffset));
   // r4: source FixedArray
   // r5: number of elements (smi-tagged)
 
   // Allocate new FixedDoubleArray.
   __ mov(lr, Operand(FixedDoubleArray::kHeaderSize));
   __ add(lr, lr, Operand(r5, LSL, 2));
   __ AllocateInNewSpace(lr, r6, r7, r9, &gc_required, NO_ALLOCATION_FLAGS);
   // r6: destination FixedDoubleArray, not tagged as heap object
   // Set destination FixedDoubleArray's length and map.
   __ LoadRoot(r9, Heap::kFixedDoubleArrayMapRootIndex);
   __ str(r5, MemOperand(r6, FixedDoubleArray::kLengthOffset));
   __ str(r9, MemOperand(r6, HeapObject::kMapOffset));
   // Update receiver's map.
 
   __ str(r3, FieldMemOperand(r2, HeapObject::kMapOffset));
   __ RecordWriteField(r2,
                       HeapObject::kMapOffset,
                       r3,
                       r9,
                       kLRHasBeenSaved,
                       kDontSaveFPRegs,
-                      EMIT_REMEMBERED_SET,
+                      OMIT_REMEMBERED_SET,
                       OMIT_SMI_CHECK);
   // Replace receiver's backing store with newly created FixedDoubleArray.
   __ add(r3, r6, Operand(kHeapObjectTag));
   __ str(r3, FieldMemOperand(r2, JSObject::kElementsOffset));
   __ RecordWriteField(r2,
                       JSObject::kElementsOffset,
                       r3,
                       r9,
                       kLRHasBeenSaved,
                       kDontSaveFPRegs,
                       EMIT_REMEMBERED_SET,
                       OMIT_SMI_CHECK);
 
   // Prepare for conversion loop.
   __ add(r3, r4, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
   __ add(r7, r6, Operand(FixedDoubleArray::kHeaderSize));
   __ add(r6, r7, Operand(r5, LSL, 2));
   __ mov(r4, Operand(kHoleNanLower32));
   __ mov(r5, Operand(kHoleNanUpper32));
   // r3: begin of source FixedArray element fields, not tagged
   // r4: kHoleNanLower32
   // r5: kHoleNanUpper32
   // r6: end of destination FixedDoubleArray, not tagged
   // r7: begin of FixedDoubleArray element fields, not tagged
   if (!vfp3_supported) __ Push(r1, r0);
 
   __ b(&entry);
 
+  __ bind(&only_change_map);
+  __ str(r3, FieldMemOperand(r2, HeapObject::kMapOffset));
+  __ RecordWriteField(r2,
+                      HeapObject::kMapOffset,
+                      r3,
+                      r9,
+                      kLRHasBeenSaved,
+                      kDontSaveFPRegs,
+                      OMIT_REMEMBERED_SET,
+                      OMIT_SMI_CHECK);
+  __ b(&done);
+
   // Call into runtime if GC is required.
   __ bind(&gc_required);
   __ pop(lr);
   __ b(fail);
 
   // Convert and copy elements.
   __ bind(&loop);
   __ ldr(r9, MemOperand(r3, 4, PostIndex));
   // r9: current element
   __ UntagAndJumpIfNotSmi(r9, r9, &convert_hole);
@@ skipping 28 matching lines @@
     __ Assert(eq, "object found in smi-only array");
   }
   __ Strd(r4, r5, MemOperand(r7, 8, PostIndex));
 
   __ bind(&entry);
   __ cmp(r7, r6);
   __ b(lt, &loop);
 
   if (!vfp3_supported) __ Pop(r1, r0);
   __ pop(lr);
+  __ bind(&done);
 }
 
 
 void ElementsTransitionGenerator::GenerateDoubleToObject(
     MacroAssembler* masm, Label* fail) {
   // ----------- S t a t e -------------
   //  -- r0    : value
   //  -- r1    : key
   //  -- r2    : receiver
   //  -- lr    : return address
   //  -- r3    : target map, scratch for subsequent call
   //  -- r4    : scratch (elements)
   // -----------------------------------
-  Label entry, loop, convert_hole, gc_required;
+  Label entry, loop, convert_hole, gc_required, only_change_map;
+
+  // Check for empty arrays, which only require a map transition and no changes
+  // to the backing store.
+  __ ldr(r4, FieldMemOperand(r2, JSObject::kElementsOffset));
+  __ CompareRoot(r4, Heap::kEmptyFixedArrayRootIndex);
+  __ b(eq, &only_change_map);
 
   __ push(lr);
-  __ ldr(r4, FieldMemOperand(r2, JSObject::kElementsOffset));
   __ Push(r3, r2, r1, r0);
   __ ldr(r5, FieldMemOperand(r4, FixedArray::kLengthOffset));
   // r4: source FixedDoubleArray
   // r5: number of elements (smi-tagged)
 
   // Allocate new FixedArray.
   __ mov(r0, Operand(FixedDoubleArray::kHeaderSize));
   __ add(r0, r0, Operand(r5, LSL, 1));
   __ AllocateInNewSpace(r0, r6, r7, r9, &gc_required, NO_ALLOCATION_FLAGS);
   // r6: destination FixedArray, not tagged as heap object
@@ skipping 49 matching lines @@
 
   // Replace the-hole NaN with the-hole pointer.
   __ bind(&convert_hole);
   __ str(r7, MemOperand(r3, 4, PostIndex));
 
   __ bind(&entry);
   __ cmp(r3, r5);
   __ b(lt, &loop);
 
   __ Pop(r3, r2, r1, r0);
-  // Update receiver's map.
-  __ str(r3, FieldMemOperand(r2, HeapObject::kMapOffset));
-  __ RecordWriteField(r2,
-                      HeapObject::kMapOffset,
-                      r3,
-                      r9,
-                      kLRHasBeenSaved,
-                      kDontSaveFPRegs,
-                      EMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
   // Replace receiver's backing store with newly created and filled FixedArray.
   __ str(r6, FieldMemOperand(r2, JSObject::kElementsOffset));
   __ RecordWriteField(r2,
                       JSObject::kElementsOffset,
                       r6,
                       r9,
                       kLRHasBeenSaved,
                       kDontSaveFPRegs,
                       EMIT_REMEMBERED_SET,
                       OMIT_SMI_CHECK);
   __ pop(lr);
+
+  __ bind(&only_change_map);
+  // Update receiver's map.
+  __ str(r3, FieldMemOperand(r2, HeapObject::kMapOffset));
+  __ RecordWriteField(r2,
+                      HeapObject::kMapOffset,
+                      r3,
+                      r9,
+                      kLRHasNotBeenSaved,
+                      kDontSaveFPRegs,
+                      OMIT_REMEMBERED_SET,
+                      OMIT_SMI_CHECK);
 }
 
 
 void StringCharLoadGenerator::Generate(MacroAssembler* masm,
                                        Register string,
                                        Register index,
                                        Register result,
                                        Label* call_runtime) {
   // Fetch the instance type of the receiver into result register.
   __ ldr(result, FieldMemOperand(string, HeapObject::kMapOffset));
@@ skipping 74 matching lines @@
   // Ascii string.
   __ ldrb(result, MemOperand(string, index));
   __ bind(&done);
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM